| Index: content/common/gpu/media/media_messages.cc
|
| diff --git a/content/common/gpu/media/media_messages.cc b/content/common/gpu/media/media_messages.cc
|
| index 88364d9465eeb6029d1d6ee58151f4ed8a190fca..6b9648d80d89162b2407b09a432d27d4182034f8 100644
|
| --- a/content/common/gpu/media/media_messages.cc
|
| +++ b/content/common/gpu/media/media_messages.cc
|
| @@ -16,6 +16,8 @@ void ParamTraits<media::BitstreamBuffer>::Write(base::Pickle* m,
|
| const param_type& p) {
|
| WriteParam(m, p.id());
|
| WriteParam(m, static_cast<uint64_t>(p.size()));
|
| + DCHECK_GE(p.offset(), 0);
|
| + WriteParam(m, static_cast<uint64_t>(p.offset()));
|
| WriteParam(m, p.presentation_timestamp());
|
| WriteParam(m, p.key_id());
|
| if (!p.key_id().empty()) {
|
| @@ -30,7 +32,9 @@ bool ParamTraits<media::BitstreamBuffer>::Read(const base::Pickle* m,
|
| param_type* r) {
|
| DCHECK(r);
|
| uint64_t size = 0;
|
| + uint64_t offset = 0;
|
| if (!(ReadParam(m, iter, &r->id_) && ReadParam(m, iter, &size) &&
|
| + ReadParam(m, iter, &offset) &&
|
| ReadParam(m, iter, &r->presentation_timestamp_) &&
|
| ReadParam(m, iter, &r->key_id_)))
|
| return false;
|
| @@ -42,6 +46,13 @@ bool ParamTraits<media::BitstreamBuffer>::Read(const base::Pickle* m,
|
| }
|
| r->size_ = checked_size.ValueOrDie();
|
|
|
| + base::CheckedNumeric<off_t> checked_offset(offset);
|
| + if (!checked_offset.IsValid()) {
|
| + DLOG(ERROR) << "Invalid offset: " << offset;
|
| + return false;
|
| + }
|
| + r->offset_ = checked_offset.ValueOrDie();
|
| +
|
| if (!r->key_id_.empty()) {
|
| if (!(ReadParam(m, iter, &r->iv_) && ReadParam(m, iter, &r->subsamples_)))
|
| return false;
|
|
|